IIT Home Page CNR Home Page

How to Grant Less Permissions to Facebook Applications

Single Sign-On (SSO) is an authentication procedure that allows users to adopt the same credentials to access multiple services. On the other hand, OAuth 2.0 is a protocol that enables authorized applications to access data that are stored in a resource server. A practical example of the adoption of SSO with OAuth 2.0 is given by all the websites or applications that use the “Log in with Facebook” procedure to authenticate users already registered with Facebook.

In this paper, we propose a mechanism that exploits a weakness of OAuth 2.0 and a missing control of the website to show how it is possible to register a user by reducing the number of scopes that the website requires with the “Log in with Facebook” procedure. Finally, we illustrate two examples that exploit the proposed mechanism and provide a solution to address the problem. 


IAS 2013, Yassmine Hammamet – Tunisia, 2013

Autori IIT:

Daniele Sgandurra

Foto di Daniele Sgandurra

Tipo: Articolo in Atti di convegno internazionale con referee
Area di disciplina: Information Technology and Communication Systems

Attività: Architectures, protocols and mechanisms for the security of distributed services and systems
Social Networking